HIGHSupply Chain
Verified
Global

Cl0p Mass Exploits Cleo File Transfer Zero-Day — 600+ Organizations Hit

·Source: Huntress / Cleo Advisory

Updated:

Executive Summary

Cl0p launches fourth major file transfer campaign exploiting Cleo Harmony, VLTrader, and LexiCom zero-day. Systematic data exfiltration ongoing.

Analysis

CVE-2026-27891 is a deserialization flaw in Cleo products allowing unauthenticated RCE. Huntress detected exploitation March 18. Over 600 organizations compromised. This is Cl0p fourth file transfer campaign after Accellion, GoAnywhere, and MOVEit.

Timeline

Discovered
Mar 18, 2026
Exploitation Detected
Mar 18, 2026
Published
Mar 22, 2026
Patch Available
Mar 21, 2026

Indicators of Compromise (1)

CVE (1)
CVE-2026-27891
NVDMITRE CVE
Source Attribution

Originally published by Huntress / Cleo Advisory on Mar 22, 2026. Verified by: Huntress, CISA, Cleo.

Related Threats

CRITICALSupply Chain

Critical GitLab flaw allows attackers to delete and modify public repos

GitLab has fixed a critical vulnerability that could allow unauthenticated attackers to perform unauthorized modifications inside code repositories or to completely delete them with a single HTTP request. The patched releases also address a second high-risk cross-site request forgery (CSRF) flaw. The critical vulnerability, tracked as CVE-2026-19478 , is described as a code injection issue through

CVE-2026-19478CVE-2026-19650
CSO Online
MEDIUMSupply Chain

Securing Software at the Speed of AI: What Four Years of Data Reveal

<div class="hs-featured-image-wrapper"> <a href="https://www.sonatype.com/blog/securing-software-at-the-speed-of-ai-what-four-years-of-data-reveal" title="" class="hs-featured-image-link"> <img src="https://www.sonatype.com/hubfs/AI%20ERA%20SOFTWARE%20ASSEMBLY%20BLOG.png" alt="Image with statistics and text regarding AI software assembly" class="hs-featured-image" style="width:auto !important; max

Sonatype (Maven/npm)
HIGHSupply Chain

OpenAI president’s blog pushing agentic AI most notable for what it did not say

OpenAI president Greg Brockman on Sunday warned enterprise CISOs that they need to more aggressively embrace agents if they want to survive upcoming cyberattacks. Brockman said in a blog post that it has become “increasingly clear” that company systems are hiding “significant flaws, and defenders need to find and fix them before attackers do.” He added: “The Hugging Face incident showed that we un

CSO Online